Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on wheth…
Info
Summary
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent accoun…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/LemmyNet/lemmy/commit/4d235a1b668b7dda6b73dbbc9ca289bb40acfa83
- https://github.com/LemmyNet/lemmy/commit/59e968a5ac36d36d08a59028e2dbb92641536964
- https://github.com/LemmyNet/lemmy/pull/6531
- https://github.com/LemmyNet/lemmy/pull/6535
- https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
- https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-beta.1
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xgg7-8hvq-8m65
- https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
Timeline
- nvd_ingest NVD